[CW] W32.Klez.e@MM virus

[Ken Lotts]

I thought you might be interested to know that according to
"www.antivirus.com" the Klez virus does in fact spoof
addresses..

>From the www.antivirus.com site:

"Similar to the other KLEZ variants, this worm can change or spoof the
original email address in the FROM: field. It obtains the email addresses
that it places in the FROM: field from the infected user's address
book. This causes a non-infected user to appear as the person who has sent
this worm's malicious email. It does this to hide the real sender of the
infected email."

As postmaster for an ISP, I am seeing numerous situations of spoofed
return addresses in Klez virus messages ..causing all sorts of erroneous
finger pointing.  

Ken Lotts aa7jc